# Running OpenEMR with in-cluster LDAP authentication via lldap

**URL:** <https://community.open-emr.org/t/running-openemr-with-in-cluster-ldap-authentication-via-lldap/26697>\
**Category:** Management and Administration\
**Tags:** infrastructure, installation, feature\
**Created:** [April 8, 2026, 12:53pm UTC](https://community.open-emr.org/t/running-openemr-with-in-cluster-ldap-authentication-via-lldap/26697 "2026-04-08T12:53:20Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ryan\_Nix](https://community.open-emr.org/user_avatar/community.open-emr.org/ryan_nix/32/11186_2.png) [@Ryan\_Nix](https://community.open-emr.org/u/Ryan_Nix)\
**Post date:** [April 8, 2026, 12:53pm UTC](https://community.open-emr.org/t/running-openemr-with-in-cluster-ldap-authentication-via-lldap/26697/1 "2026-04-08T12:53:20Z")

</div>

If you’re running OpenEMR on Red Hat OpenShift — particularly the free Developer Sandbox — you’ve probably run into the challenge of wanting LDAP authentication without the complexity of standing up a full directory service or depending on an external one.

I’ve been working on a container project that solves this: **lldap-on-openshift** deploys [lldap](https://github.com/lldap/lldap), a lightweight Rust-based LDAP server, directly into the same namespace as OpenEMR. Authentication traffic stays on the pod network and never leaves the cluster.

**Why lldap instead of OpenLDAP?**

`openldap-servers` was removed from RHEL 8 and all downstream distributions. Getting OpenLDAP running under OpenShift’s restricted Security Context Constraints is a significant challenge — it requires runtime `chown` and `gosu` calls that the restricted SCC won’t allow. lldap’s binary runs natively as an arbitrary UID with no privilege escalation needed, and it includes a web UI for managing users without any LDIF files or command-line tools.

**Connecting to OpenEMR 8.x**

Navigate to **Admin → Config → Security** and set:

- **Use LDAP for Authentication** — enabled

- **LDAP - Server Name or URI** — `ldap://lldap:3890`

- **LDAP - Distinguished Name of User** — `uid={login},ou=people,dc=example,dc=com`

One important note: OpenEMR validates the password against lldap but still requires the user to exist in its own database. Create the user in lldap first, then create a matching record in OpenEMR under **Admin → User Administration** with the same username. The OpenEMR password is ignored once LDAP is enabled.

 ![Screenshot 2026-04-08 at 7.48.40 AM](https://discourse-uploads-openemr.s3.dualstack.us-east-1.amazonaws.com/original/3X/5/1/5100938bfab2c25b832ad487ad4c8fa081f0283b.jpeg)

 ![Screenshot 2026-04-08 at 7.49.42 AM](https://discourse-uploads-openemr.s3.dualstack.us-east-1.amazonaws.com/original/3X/8/b/8b445e4b8f5bab347a2071d12dc2d54b9250d62e.jpeg)

**Resources**

The project includes an Ansible playbook that handles everything — TLS cert injection via OpenShift’s service cert controller, PVC provisioning, and deployment — in a single command:

```auto
ansible-playbook -i localhost, deploy.yml

```

Cleanup is equally simple:

```auto
ansible-playbook -i localhost, deploy.yml -e deploy_action=delete

```

GitHub: [GitHub - ryannix123/lldap-on-openshift: Self contained openldap server for OpenShift projects · GitHub](https://github.com/ryannix123/lldap-on-openshift)  
Image: `quay.io/ryan_nix/lldap-openshift:latest` (multi-arch, rebuilt weekly)

Happy to answer questions from anyone running OpenEMR on Kubernetes or OpenShift.